RomanNum3ral
/
whisper-money
mirror of https://github.com/whisper-money/whisper-money.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(mcp): keep Passport signing keys at 600 in production 

The entrypoint's recursive `chmod -R 775 /app/storage` widened the generated
oauth-private.key/oauth-public.key to 775, which league/oauth2-server rejects
(it wants 600/660) — logging a warning on every /oauth/authorize and /mcp/oauth
request. Re-tighten the keys to 600 after the storage chmod. Runs every boot,
so it also fixes keys left at 775 on a persisted volume.
This commit is contained in:
Víctor Falcón 2026-07-17 21:08:46 +02:00
parent 6d5f440727
commit 804cf90954
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docker/entrypoint.sh
View File

@ -109,6 +109,13 @@ chown -R www-data:www-data /app/storage /app/bootstrap/cache
chmod -R 775 /app/storage /app/bootstrap/cache
chmod 664 /app/storage/logs/laravel.log
# Passport signing keys must stay private: the recursive chmod above widens them
# to 775, but league/oauth2-server rejects any mode other than 600/660 and logs a
# warning on every /oauth/authorize and /mcp/oauth request. Lock them back down.
if [ -f /app/storage/oauth-private.key ]; then
chmod 600 /app/storage/oauth-private.key /app/storage/oauth-public.key
fi
echo "=== Startup complete, launching services ==="
# Start supervisor